Privacy Policy

1. Data Controller

The controller of the personal data collected through this website and its subdomains is:

Controller: Fundació d’Estudis i Recerca Oncològica (FERO)
NIF: G62663661
Address: Avenida Diagonal 612, 4º 08021 Barcelona, Spain
Telephone: +34 900 680 434
Email: fero@ferocancer.org
Website: https://ferocancer.org

For any queries related to personal data protection, you may contact FERO via email at fero@ferocancer.org or in writing to its postal address, indicating “Data Protection” in the subject line.

2. Scope of Application

This Privacy Policy applies to the processing of personal data carried out through fero.org, its subdomains, forms, donation platforms, solidarity campaigns, and other digital channels managed by the FERO Foundation.

Certain services, such as the Internal Information and Whistleblowing Channel, grant calls, events, or external donation platforms, may include additional and specific information on data processing.

In the event of a contradiction, the specific information provided at the time of data collection shall prevail.

3. Principles Applicable to Processing

The FERO Foundation will process personal data in accordance with the following principles:

Lawfulness, fairness, and transparency: data will be processed legitimately, and data subjects will be clearly informed.
Purpose limitation: data will be used solely for the purposes informed.
Data minimization: only adequate, relevant, and necessary data will be requested.
Accuracy: efforts will be made to ensure data is up to date and correct.
Storage limitation: data will be kept only for the time necessary or legally required.
Integrity and confidentiality: security measures will be applied to protect data against unauthorized access, loss, alteration, or disclosure.

4. Source of Data

Personal data processed by the FERO Foundation may come from:

The data subjects themselves, through forms, emails, telephone calls, donations, registrations, or communications.
Their legal representatives, parents, or guardians.
Companies, entities, research centers, universities, or institutions with which a professional or collaborative relationship is maintained.
Financial entities, payment gateways, and crowdfunding or donation platforms.
Organizers, collaborators, or sponsors of activities and events.
Publicly accessible sources, only when their consultation is lawful, proportionate, and necessary for a legitimate purpose.

When a person provides data of third parties, they must have sufficient legitimacy to do so and inform them about the processing of their data when necessary.

5. Purposes and Legal Bases

5.1 Inquiries and Contact Forms

Data provided through forms, email, telephone, or other channels will be processed to:

Address inquiries, requests for information, suggestions, complaints, or claims.
Manage communications related to FERO’s projects, activities, or services.
Carry out the necessary actions to respond to the request made.

The legal basis will be the consent of the data subject and, when the inquiry is related to a possible contractual, collaborative, or participatory relationship, the application of pre-contractual measures requested by them.

5.2 One-time and Recurring Donations

Donors’ data will be processed to:

Process and manage one-time, periodic, or project-specific donations.
Manage collections, direct debits, modifications, renewals, and cancellations.
Maintain the relationship with donors and address their inquiries.
Maintain administrative, accounting, and tax control of contributions.
Issue and send tax certificates where applicable.
Prevent fraud and comply with obligations regarding the prevention of money laundering and terrorist financing.
Justify the destination and application of the funds received.

The legal bases will be the execution of the donation or collaboration relationship, compliance with legal obligations and, in certain cases, FERO’s legitimate interest in properly managing its resources and preventing fraudulent actions.

When the donation is made through a bank, payment gateway, or external platform, the necessary data may be processed by said providers to authorize and manage the operation.

The FERO Foundation will not necessarily access full bank card details, which may be processed directly by the corresponding payment provider.

Foundations must identify and verify the identity of persons who provide funds or resources free of charge for an amount equal to or greater than €100.

5.3 Members and Collaborators

Data of members, collaborators, and persons linked to the FERO Foundation will be processed to:

Manage their registration, relationship, and contributions.
Process periodic fees and contributions.
Inform about the destination of contributions and funded projects.
Address inquiries and requests.
Send tax certificates.
Conduct satisfaction surveys and improve the relationship with collaborators.
Invite to activities, acts, and events related to the Foundation.

The legal basis will be the execution of the relationship established with FERO, compliance with legal obligations, and the legitimate interest in maintaining and improving said relationship.

Promotional or fundraising communications by electronic means will be sent when there is consent or any other authorization permitted by applicable regulations.

5.4 Informative Communications and Newsletters

When the user subscribes to the newsletter or expressly authorizes the receipt of communications, their data may be used to send:

News and updates about the FERO Foundation.
Information on oncology research and funded projects.
Awareness and fundraising campaigns.
Invitations to events, galas, activities, and solidarity acts.
Information on donations, collaborations, and other forms of participation.

These communications may be sent by email, telephone, SMS, instant messaging, or postal mail, according to the preferences expressed.

The legal basis will be consent, which may be withdrawn at any time via the unsubscribe link included in the communications or by writing to fero@ferocancer.org.

The withdrawal of consent will not affect the lawfulness of processing carried out previously.

5.5 Events, Galas, and Activities

Data of registered persons or attendees will be processed to:

Manage registrations, invitations, accreditations, and attendance.
Process contributions, tickets, or donations associated with the event.
Organize logistical, security, or accessibility matters.
Inform about changes, cancellations, or matters related to the activity.
Issue receipts or certificates where applicable.

The legal basis will be the execution of the registration or participation, consent and, where appropriate, compliance with legal obligations.

During events, photographs or audiovisual recordings may be captured for informative, documentary, or dissemination purposes of FERO’s activities. When necessary, the corresponding authorization will be requested, or prior information will be provided regarding the capture of images.

5.6 Scholarships, Grants, and Research Calls

Data of researchers, representatives of institutions, team members, and candidates will be processed to:

Manage the submission and evaluation of applications.
Verify compliance with the requirements established in the terms and conditions.
Contact participants.
Organize the scientific and administrative evaluation of projects.
Communicate and publish resolutions when provided for in the terms and conditions.
Manage the grants awarded, their payment, monitoring, and justification.
Comply with administrative, tax, accounting, and transparency obligations.

The data processed may include identifying, academic, professional, curricular, economic, scientific, and institutional information.

The legal basis will be the application of pre-contractual measures, the execution of the relationship derived from the call, consent when applicable, compliance with legal obligations, and FERO’s legitimate interest in evaluating and managing applications.

Data may be communicated to members of scientific committees, external evaluators, collaborating entities, sponsors, or participating institutions when necessary to develop the call and always under the corresponding confidentiality obligations.

5.7 Legacies and Inheritances

Data of persons interested in making a legacy or testamentary provision in favor of FERO will be processed to:

Address requests for information.
Maintain necessary communications with the interested person, their representatives, heirs, notaries, or advisors.
Manage the acceptance, administration, and application of inheritances and legacies.
Comply with the corresponding legal, tax, accounting, and administrative obligations.

The legal basis will be consent, the application of measures requested by the data subject, compliance with legal obligations, and the FERO Foundation’s legitimate interest in correctly managing the provisions made in its favor.

5.8 Companies, Suppliers, Sponsors, and Professional Collaborators

Professional contact data will be processed to:

Manage contractual, commercial, institutional, or collaborative relationships.
Process quotes, contracts, invoices, payments, and communications.
Coordinate projects, campaigns, events, and joint activities.
Comply with applicable legal obligations.

The legal basis will be the execution of the contract or agreement, compliance with legal obligations, and the legitimate interest in maintaining professional and institutional relationships.

5.9 Volunteering

When the FERO Foundation develops volunteering programs, data will be processed to:

Manage applications for participation and selection processes.
Assign functions and coordinate activities.
Provide training and information.
Manage insurance, accreditations, and legal obligations.
Maintain communication with volunteers.

The legal basis will be the application of pre-contractual measures, the execution of the volunteering relationship, compliance with legal obligations, and consent when necessary.

5.10 Selection Processes and Professional Applications

CVs and applications received will be processed to:

Evaluate the experience and suitability of candidates.
Manage current or future selection processes.
Contact candidates.

The legal basis will be consent and the application of pre-contractual measures.

Data will be kept during the selection process and, unless another period is indicated or its conservation is expressly authorized, it will be deleted when it is no longer necessary.

5.11 Testimonials, Personal Stories, and Images

When an individual contributes a testimonial, personal story, image, video, or experience related to cancer, research, or FERO’s activities, their data will be processed to prepare, publish, and disseminate such content through the expressly authorized channels.

When these contents include health information, the explicit consent of the affected person will be requested, unless another valid legal basis exists.

The person may withdraw their consent, without prejudice to materials already published or legitimately used previously and reasonable technical limitations for withdrawing content already disseminated.

5.12 Solidarity Campaigns and Challenges

Data of persons who create, promote, or participate in solidarity campaigns and challenges will be processed to:

Create and manage the campaign.
Manage donations and contributions received.
Facilitate the dissemination and monitoring of the initiative.
Communicate with the organizer and participants.
Prevent fraud or misuse.

When the donor chooses to make their contribution public, their name, amount, date, message, or the data they have authorized may be shown in the campaign. Anonymous donations will not publicly display the donor’s identity.

The legal basis will be the execution of participation in the campaign, consent, compliance with legal obligations, and the legitimate interest in managing and protecting the initiative.

5.13 Website Security

Technical data associated with browsing, such as IP address, access logs, device information, or security incidents, may be processed to:

Ensure the operation and security of the website.
Prevent unauthorized access, fraud, and malicious activities.
Detect errors, attacks, or technical manipulations.
Maintain security logs and resolve incidents.

The legal basis will be the FERO Foundation’s legitimate interest in protecting its systems, information, services, and users, as well as compliance with applicable legal obligations.

5.14 Cookies and Similar Technologies

Data obtained through cookies and similar technologies will be processed as indicated in the Cookies Policy.

Necessary technical cookies may be used without consent. Remaining cookies will only be installed when the user accepts them through the consent manager.

5.15 Internal Information and Whistleblowing Channel

Communications received through the Internal Information and Whistleblowing Channel will be treated confidentially, with restricted access and in accordance with its specific regulations.

Full information on purposes, legal bases, recipients, and storage periods will be available on the channel’s own page and form.

6. Categories of Data Processed

Depending on the relationship maintained with the FERO Foundation, the following categories may be processed:

Identifying data: name, surname, identity document, signature, date of birth, or user identifiers.
Contact data: postal address, email, and telephone.
Economic and financial data: bank account, information on contributions, fees, donations, transactions, and tax certificates.
Professional and academic data: training, experience, CV, position, institution, research activity, and publications.
Data related to activities: registrations, attendance, participation, preferences, and communications.
Images and recordings: photographs, videos, and voice.
Technical data: IP address, access logs, device, browser, and data associated with security.
Data of representatives or guardians: when acting on behalf of another person or a minor.
Special categories of data: mainly health data included in testimonials, personal stories, or communications, only when necessary and a valid legal basis exists.

The FERO Foundation does not request health data to be provided through general contact forms. It is recommended not to include unnecessary medical information.

7. Data of Minors

Persons under 14 years of age may not provide valid consent for the processing of their personal data on their own.

When it is necessary to process data of minors under 14 years of age, the consent of their parents, guardians, or legal representatives will be requested.

The FERO Foundation may request reasonable documentation to verify the minor’s age, parentage, guardianship, or representation.

In events, activities, campaigns, or audiovisual content involving minors, specific information will be provided and the necessary authorizations will be collected.

8. Mandatory Nature of Data

Fields marked as mandatory in forms are necessary to manage the corresponding request, donation, registration, or service.

Refusal to provide this data may prevent the FERO Foundation from processing the request or establishing the requested relationship.

The user guarantees that the data provided is true, accurate, complete, and up to date.

9. Recipients of Data

Personal data may be communicated to:

Public administrations, regulatory bodies, courts, tribunals, and law enforcement agencies when there is a legal obligation.
Tax administration and competent bodies to manage tax certificates and obligations related to donations.
Financial entities, banks, payment providers, and donation platforms.
Notaries, registries, legal advisors, and other parties involved in inheritances and legacies.
Research centers, universities, evaluators, scientific committees, sponsors, and collaborating entities in calls and projects.
Insurers, medical services, or security providers when necessary to organize activities.
Technology providers, web hosting, email, messaging, maintenance, storage, member management, printing, marketing, event organization, or administrative support.

These providers will act as data processors when they process data following FERO’s instructions and must offer sufficient guarantees of confidentiality and security.

Data will not be sold or transferred to third parties for their own commercial purposes without a valid legal basis.

10. International Transfers

Some technology providers might process data from countries located outside the European Economic Area.

When an international transfer occurs, the FERO Foundation will verify that it is covered by an adequacy decision of the European Commission, standard contractual clauses, binding corporate rules, or another mechanism recognized by regulations.

When necessary, specific information will be provided about the provider, the destination country, and the guarantees applied.

11. Storage Periods

Data will be kept for the following periods:

Inquiries and requests: for the time necessary to respond and, subsequently, during the limitation periods for possible liabilities.
Members and donors: while the relationship is maintained and during the applicable legal, tax, accounting, and administrative periods.
Prevention of money laundering: legally required documentation will be kept for ten years and will be deleted once said period has ended.
Newsletters and communications: until consent is withdrawn or unsubscription is requested.
Events and activities: for the time necessary to manage the activity and address possible liabilities.
Scholarships and calls: during the call, execution, and justification of the grant and during the periods required by the regulations or corresponding terms and conditions.
Selection processes: during the process and, subsequently, only when there is authorization to keep the application.
Inheritances and legacies: for the time necessary for their management and during the applicable legal periods.
Images and testimonials: while the authorization remains in force or while they are necessary for the informed purpose.
Technical data and security logs: for the period strictly necessary to ensure security, investigate incidents, and address possible liabilities.

When data is no longer necessary, it will be deleted or blocked to prevent its processing, remaining only at the disposal of authorities, courts, and tribunals during the corresponding legal periods.

12. Automated Decisions and Profiling

The FERO Foundation does not adopt decisions based solely on automated processing that produce legal effects or significantly affect individuals.

Basic segmentation may be carried out to adapt communications to the relationship maintained with the Foundation, for example, differentiating between members, donors, researchers, event participants, or subscribers.

These segmentations will not involve automated decisions with legal effects.

13. Rights of Data Subjects

Data subjects may exercise the following rights:

Access: to know what personal data the FERO Foundation processes.
Rectification: to request the correction of inaccurate or incomplete data.
Erasure: to request the deletion of data when it is no longer necessary or another legal cause exists.
Objection: to request that data not be processed in certain circumstances.
Restriction: to request that processing be restricted in the cases provided for by law.
Portability: to receive the data provided in a structured, commonly used, and machine-readable format and, where possible, transmit it to another controller.
Withdrawal of consent: to withdraw previously granted consent at any time.
Not to be subject to exclusively automated decisions: when they produce legal effects or significantly affect them.

To exercise these rights, a request must be sent to:

Email: fero@ferocancer.org
Postal address: C/ Canàries 21, ground floor, 08017 Barcelona, Spain
Subject: Data Protection

The request must indicate the right to be exercised and provide the necessary information to identify the requester. When there are reasonable doubts about their identity, the FERO Foundation may request additional information.

The data subject may also file a complaint with the Spanish Data Protection Agency when they consider that the processing of their data does not comply with regulations.

14. Security and Confidentiality

The FERO Foundation applies appropriate technical and organizational measures to protect personal data, taking into account the nature of the information, the context of the processing, and existing risks.

Access to data is limited to personnel, professionals, and providers who need it to carry out their functions and who are subject to confidentiality obligations.

However, no system connected to the Internet can guarantee absolute security. In the event of a security breach that could pose a risk to the rights and freedoms of individuals, the FERO Foundation will act in accordance with applicable legal procedures and obligations.

15. Links and Third-Party Services

The website may include links, videos, maps, social networks, forms, donation platforms, or services managed by third parties.

These third parties may process data according to their own privacy policies. It is recommended to review said information before using the external service.

The inclusion of a link does not imply that the FERO Foundation controls the third party’s privacy practices.

16. Social Networks

When a person interacts with the FERO Foundation’s official profiles on social networks, their data will be processed according to the platform’s conditions and to:

Manage comments, messages, and inquiries.
Disseminate the Foundation’s activities.
Organize campaigns, acts, or initiatives.
Moderate content contrary to the law, third-party rights, or participation rules.

The voluntary publication of information on a social network may make it visible to other users. It is recommended not to share unnecessary personal data or sensitive information.

17. Policy Modifications

The FERO Foundation may update this Privacy Policy to adapt it to regulatory, organizational, technological changes or those related to its activities.

The current version will be the one published on the website. When changes are significant, affected persons will be informed by reasonable means.

Last updated: June 2026.